Skip to content

ffmpeg-headless: fix signing on darwin - #513225

Closed
kirillrdy wants to merge 1 commit into
NixOS:stagingfrom
kirillrdy:ffmpeg-sign-on-mac
Closed

ffmpeg-headless: fix signing on darwin#513225
kirillrdy wants to merge 1 commit into
NixOS:stagingfrom
kirillrdy:ffmpeg-sign-on-mac

Conversation

@kirillrdy

@kirillrdy kirillrdy commented Apr 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

not sure if the best fix, but fixes a bunch of consumers of ffmpeg-headless on darwin

cc @GaetanLepage @sarahec

Things done

  • Built on platform:
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • Tested, as applicable:
  • Ran nixpkgs-review on this PR. See nixpkgs-review usage.
  • Tested basic functionality of all binary files, usually in ./result/bin/.
  • Nixpkgs Release Notes
    • Package update: when the change is major or breaking.
  • NixOS Release Notes
    • Module addition: when adding a new NixOS module.
    • Module update: when the change is significant.
  • Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

@kirillrdy kirillrdy changed the title ffmpeg-headless: fix signing on darwing ffmpeg-headless: fix signing on darwin Apr 24, 2026
@kirillrdy
kirillrdy force-pushed the ffmpeg-sign-on-mac branch from 4f929e5 to 8bc0a03 Compare April 24, 2026 23:30
@kirillrdy
kirillrdy marked this pull request as ready for review April 24, 2026 23:30
github-actions[bot]

This comment was marked as outdated.

Sign in to view

@kirillrdy
kirillrdy marked this pull request as draft April 24, 2026 23:38
@kirillrdy
kirillrdy force-pushed the ffmpeg-sign-on-mac branch from 8bc0a03 to 29aa77f Compare April 24, 2026 23:38
@kirillrdy
kirillrdy changed the base branch from master to staging April 24, 2026 23:39
@nixpkgs-ci nixpkgs-ci Bot closed this Apr 24, 2026
@nixpkgs-ci nixpkgs-ci Bot reopened this Apr 24, 2026
@kirillrdy
kirillrdy marked this pull request as ready for review April 24, 2026 23:39
github-actions[bot]

This comment was marked as outdated.

Sign in to view

@github-actions
github-actions Bot dismissed their stale review April 24, 2026 23:39

Review dismissed automatically

@nixpkgs-ci nixpkgs-ci Bot added 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux. 10.rebuild-darwin: 5001+ This PR causes many rebuilds on Darwin and must target the staging branches. labels Apr 24, 2026
@ofborg ofborg Bot added the 6.topic: darwin Running or building packages on Darwin label Apr 25, 2026
@kirillrdy
kirillrdy force-pushed the ffmpeg-sign-on-mac branch from 29aa77f to 1e1b09b Compare April 25, 2026 05:05
@kirillrdy

kirillrdy commented Apr 25, 2026

Copy link
Copy Markdown
Member Author

talking on matrix, it could be transient sign issue, so this PR doesn't actually fix it

@jopejoe1

jopejoe1 commented Apr 28, 2026

Copy link
Copy Markdown
Member

If this fixed signing it will probably fix #511265 and #514347.

From the ffmpeg maintainers @emilazy is probably the most knowledgeable about Darwin, and I would like to hear her opinion on this change.

This was linked to issues Apr 28, 2026
ffmpeg: invalid signature on aarch64-darwin #511265
Open
Build failure: kvazaar #514347
Closed
amarshall
amarshall reviewed May 1, 2026
View reviewed changes
Comment thread pkgs/development/libraries/ffmpeg/generic.nix

@amarshall amarshall May 1, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The problem with the underlying bug is that it’s a non-deterministic impurity. So you can’t actually trivially test if this produces any meaningful change without being able to reproduce or verify that the particular build was going to be broken anyway.

Simply making any change to the drv will cause a rebuild that will likely work, regardless of this change.

@yzx9 yzx9 mentioned this pull request May 2, 2026
Closed
23 tasks
eveeifyeve
eveeifyeve reviewed May 15, 2026
View reviewed changes
Comment thread pkgs/development/libraries/ffmpeg/generic.nix
perl
pkg-config
]
++ optionals stdenv.hostPlatform.isDarwin [ darwin.sigtool ]

@eveeifyeve eveeifyeve May 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would IMO wanting to be aiming to use rcodesign instead of sigtool in here. But again that can be done in a followup.

@delafthi delafthi May 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not using autoSignDarwinBinariesHook?

@nixpkgs-ci nixpkgs-ci Bot added the 12.approvals: 1 This PR was reviewed and approved by one person. label May 15, 2026
@kirillrdy

kirillrdy commented May 15, 2026

Copy link
Copy Markdown
Member Author

python3Packages.av builds on staging-next

@kirillrdy kirillrdy closed this May 15, 2026
@kirillrdy
kirillrdy deleted the ffmpeg-sign-on-mac branch May 15, 2026 21:24
@GaetanLepage

GaetanLepage commented May 15, 2026

Copy link
Copy Markdown
Contributor

python3Packages.av builds on staging-next

Nice!

@eveeifyeve

eveeifyeve commented May 16, 2026

Copy link
Copy Markdown
Member

So this pr isn't needed and fixes the kvazaar?

@kirillrdy

kirillrdy commented May 16, 2026

Copy link
Copy Markdown
Member Author

So this pr isn't needed and fixes the kvazaar?

I am not aware of kvazaar does it build on staging next ?

@eveeifyeve

eveeifyeve commented May 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

So this pr isn't needed and fixes the kvazaar?

I am not aware of kvazaar does it build on staging next ?

So is it something that ffmpeg fixed I guess then?? It builds fine on staging-next.

@kirillrdy

kirillrdy commented May 16, 2026

Copy link
Copy Markdown
Member Author

So this pr isn't needed and fixes the kvazaar?

I am not aware of kvazaar does it build on staging next ?

So is it something that ffmpeg fixed I guess then?? It builds fine on staging-next.

Its a transient issue,eg if you rebuild locally it most likely fixed itself

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments
@Atemu Atemu Awaiting requested review from Atemu
@Bot-wxt1221 Bot-wxt1221 Awaiting requested review from Bot-wxt1221
@emilazy emilazy Awaiting requested review from emilazy
@jopejoe1 jopejoe1 Awaiting requested review from jopejoe1
@justinas justinas Awaiting requested review from justinas
@nyanloutre nyanloutre Awaiting requested review from nyanloutre
+3 more reviewers
@amarshall amarshall amarshall left review comments
@delafthi delafthi delafthi left review comments
@eveeifyeve eveeifyeve eveeifyeve approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

6.topic: darwin Running or building packages on Darwin 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 5001+ This PR causes many rebuilds on Darwin and must target the staging branches. 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux. 12.approvals: 1 This PR was reviewed and approved by one person.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

ffmpeg: invalid signature on aarch64-darwin Build failure: kvazaar

6 participants

@kirillrdy @jopejoe1 @GaetanLepage @eveeifyeve @amarshall @delafthi